cloudflare

Latest CVEs · RSS

• CVE-2026-11325 2026-08-12 · CVSS 8.8
  Description Cloudflare was recently notified by external researchers of vulnerabilities in this archived repository, including a remote code execution issue
• CVE-2026-12523 2026-07-14 · CVSS 7.5
  Summary Cloudflare quiche's HTTP/3 layer was discovered to be vulnerable to resource exhaustion (i.e., memory) by means of specially crafted HTTP/3 frames.
• CVE-2026-12707 2026-07-14 · CVSS 7.5
  Summary Cloudflare quiche was discovered to be vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events.
• CVE-2026-14440 2026-07-01 · CVSS 7.6
  Description: To issue and renew TLS certificates on behalf of customers, Cloudflare's Universal SSL feature automatically manages the CAA RRset for the cust
• CVE-2026-11941 2026-06-19 · CVSS 5.6
  Cloudflare Quiche was affected by 2 use-after-free vulnerabilities in the connection ID iterator FFI functions. The “quiche_connection_id_iter_next” and “qui
• CVE-2026-2836 2026-03-04 · CVSS 8.4
  A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP c
• CVE-2026-2835 2026-03-04 · CVSS 9.3
  An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improp
• CVE-2026-2833 2026-03-04 · CVSS 9.3
  An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a
• CVE-2026-3125 2026-03-04 · CVSS 7.7
  A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-
• CVE-2026-1229 2026-02-24 · CVSS 2.9
  The CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs. The issue is fixed by using complete
• CVE-2026-1721 2026-02-13 · CVSS 6.2
  Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parame
• CVE-2026-1664 2026-02-03 · CVSS 6.9
  Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare Agents SDK. The issue
• CVE-2026-0933 2026-01-20 · CVSS 7.7
  SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` p
• CVE-2025-13353 2025-12-02 · CVSS 7.1
  In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM
• CVE-2025-7054 2025-08-07 · CVSS 8.7
  Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a s
• CVE-2025-4821 2025-06-18 · CVSS 7.5
  Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pat
• CVE-2025-4820 2025-06-18 · CVSS 5.3
  Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to send data at a rate faster than the pat
• CVE-2025-6087 2025-06-16 · CVSS 7.8
  A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package. The vulnerability stems from an unimplemented feature i
• CVE-2025-4366 2025-05-22 · CVSS 7.4
  A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated r
• CVE-2025-4658 2025-05-13 · CVSS 9.3
  Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification. As OPKSSH d
• CVE-2025-3757 2025-05-13 · CVSS 9.3
  Versions of OpenPubkey library prior to 0.10.0 contained a vulnerability that would allow a specially crafted JWS to bypass signature verification.
• CVE-2025-4144 2025-05-01 · CVSS 5.3
  PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, i
• CVE-2025-4143 2025-05-01 · CVSS 6.0
  The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that re
• CVE-2021-3978 2025-01-29 · CVSS 7.5
  When copying files with rsync, octorpki uses the "-a" flag 0, which forces rsync to copy binaries with the suid bit set as root. Since the provided service defi
• CVE-2025-0651 2025-01-22 · CVSS 6.1
  Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low system privileges  can create a set of syml